Study guide
16.4 Availability, Backup, and Recovery Controls
Uniform CPA Examination Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CPA Exam Structure and Licensure Rules
1.1 CPA Evolution Model 1.2 Eligibility, Credit Window, and Scheduling Rules 1.3 Scoring, Pass Rates, and Blueprints
2 Chapter 2: CPA Scoring, Interface, and Exam Strategy
Score Scale and Testlets MCQ/TBS Weighting by Section Sample Test Interface Tools Exam-Day Time Management
3 Chapter 3: AUD Ethics, Independence, and Engagement Acceptance
3.1 Professional Responsibilities and Independence 3.2 Engagement Acceptance and Continuance 3.3 Audit Documentation and Quality Management 3.4 Audit Risk Foundations
4 Chapter 4: AUD Risk Assessment, Controls, and Evidence
4.1 Assertions and Risk Assessment 4.2 Internal Control Design and Operating Effectiveness 4.3 Substantive Procedures and Audit Evidence 4.4 Sampling, Analytics, and Estimates
5 Chapter 21: AUD Sampling, Analytics, and Accounting Estimates
21.1 Audit Sampling Risk and Sample Design 21.2 Substantive Analytical Procedures 21.3 Estimates, Fair Value, and Specialists 21.4 Data Analytics, Exceptions, and Follow-Up
6 Chapter 22: AUD Integrated Audits, IT Controls, and SOC Reliance
22.1 ICFR Integrated Audit Framework 22.2 IT General Controls and Application Controls 22.3 Service Organizations, SOC Reports, and CUECs 22.4 Control Deficiencies and Material Weaknesses
7 Chapter 5: AUD Reporting, Attestation, and Review Engagements
5.1 Audit Opinions and Modifications 5.2 Emphasis, Other Matter, and Going Concern 5.3 Review, Compilation, and Preparation Engagements 5.4 Attestation and Government Auditing Signals
8 Chapter 36: AUD Workbook - From Risk to Report
36.1 Risk-Assertion-Procedure Drill 36.2 Evidence Reliability Drill 36.3 Control Deficiency Classification Drill 36.4 Report Modification Decision Drill
9 Chapter 6: FAR Financial Statements and Reporting Framework
6.1 Conceptual Framework and Standard Setting 6.2 Financial Statement Presentation 6.3 Cash Flow Statement and Disclosures 6.4 Not-for-Profit Reporting Basics
10 Chapter 7: FAR Balance Sheet Accounts and Rollforwards
7.1 Cash, Receivables, and Reconciliations 7.2 Inventory and Cost Flow Errors 7.3 Property, Equipment, and Intangibles 7.4 Debt, Equity, and Contingencies
11 Chapter 8: FAR Selected Transactions and Measurement Models
8.1 Revenue Recognition: Five-Step Model 8.2 Leases, Income Taxes, and Impairment 8.3 Business Combinations and Consolidations 8.4 Accounting Changes, Errors, and Subsequent Events
12 Chapter 32: FAR Revenue, Leases, and Income Taxes Deep Dive
32.1 Revenue Contract Modifications and Variable Consideration 32.2 Lease Classification and Lessee Accounting 32.3 Deferred Tax Assets, Liabilities, and Valuation Allowances 32.4 Simulation Workflows for Revenue, Lease, and Tax Exhibits
13 Chapter 31: FAR Financial Instruments, Fair Value, and Derivatives
31.1 Financial Asset Classification and Measurement 31.2 Fair Value Hierarchy and Disclosures 31.3 Derivatives, Hedge Accounting, and Embedded Features 31.4 Foreign Currency and Comprehensive Income Signals
14 Chapter 24: FAR Consolidations, Equity Method, and Intercompany Workpapers
24.1 Consolidation Decision and Noncontrolling Interest 24.2 Acquisition-Date Measurement and Goodwill 24.3 Equity Method Income, Dividends, and Impairment 24.4 Intercompany Inventory, Debt, and Fixed Asset Eliminations
15 Chapter 9: FAR Governmental Accounting and Fund Reporting
9.1 Governmental Fund Types and Basis 9.2 Government-Wide Statements and Reconciliations 9.3 Budgetary Accounting and Encumbrances 9.4 Governmental and NFP Comparison Traps
16 Chapter 23: FAR Not-for-Profit and Special Reporting Topics
23.1 Not-for-Profit Net Assets and Restrictions 23.2 Contributions, Conditional Gifts, and Agency Transactions 23.3 Functional Expenses and Statement Presentation 23.4 Interim, Segment, and EPS Reporting Traps
17 Chapter 37: FAR Workbook - Journal Entries, Rollforwards, and Reconciliations
Adjusting Entry Workflow Account Rollforward Workflow Reconciliation and Error Correction Drill Statement Presentation Workpaper Drill
18 Chapter 10: REG Tax Procedure, Ethics, and Business Law
10.1 Tax Practice Ethics and Preparer Responsibilities 10.2 IRS Procedure, Statutes, and Penalties 10.3 Contracts, Agency, and Business Entities 10.4 Secured Transactions, Bankruptcy, and Priority
19 Chapter 11: REG Individual Federal Tax Workflows
11.1 Gross Income, Exclusions, and Adjustments 11.2 Filing Status, Dependents, and Deductions 11.3 Credits, Payments, and AMT Concepts 11.4 Retirement, Passive Activity, and Loss Limitations
20 Chapter 12: REG Property Transactions and Entity Taxation
12.1 Basis, Realized Gain, Recognized Gain, and Character 12.2 C Corporations and Shareholder Transactions 12.3 S Corporations, Partnerships, and Basis 12.4 Entity Tax Simulations and K-1 Workflows
21 Chapter 25: REG Entity Choice, Basis, and Owner Tax Consequences
25.1 C Corporation, S Corporation, and Partnership Comparison 25.2 Formation Contributions and Built-In Gain 25.3 Distributions, Redemptions, and Liquidations 25.4 Loss Limits: Basis, At-Risk, and Passive Rules
22 Chapter 26: REG Property Tax, Character, and Deferral Transactions
26.1 Capital, Ordinary, and Section 1231 Character 26.2 Depreciation Recapture and Unrecaptured Gain 26.3 Like-Kind Exchanges, Involuntary Conversions, and Installment Sales 26.4 Related-Party, Wash-Sale, and Imputed-Interest Traps
23 Chapter 33: REG Trusts, Estates, Gifts, and Exempt Organizations
33.1 Trust and Estate Income Tax Basics 33.2 Gift, Estate, and Beneficiary Planning Concepts 33.3 Tax-Exempt Organizations and Unrelated Business Income 33.4 Fiduciary K-1 and Distribution Simulation Workflows
24 Chapter 38: REG Workbook - Tax Return Schedules and Basis Workpapers
38.1 Individual Return Classification Drill 38.2 Property Basis and Character Workpaper 38.3 Pass-through K-1 and Owner Basis Workpaper 38.4 Business Law Issue Spotting Drill
25 Chapter 13: BAR Business Analysis, Economics, and Forecasting
13.1 Financial Statement Analysis and Ratios 13.2 Variance, Forecasting, and Budgeting 13.3 Cost Accounting and Performance Management 13.4 Economics, Finance, and Decision Models
26 Chapter 14: BAR Technical Accounting and Advanced Reporting
14.1 Revenue, Leases, and Complex Arrangements 14.2 Derivatives, Hedges, and Fair Value 14.3 Business Combinations and Consolidations 14.4 SEC Reporting and Public Company Context
27 Chapter 15: BAR State and Local Government Analysis
15.1 Governmental Fund Analysis 15.2 Government-Wide Conversion Workflows 15.3 Budgetary Reconciliation and CAFR/ACFR Reading 15.4 Government Simulation Strategy
28 Chapter 16: ISC Information Systems and Data Management
16.1 Systems Architecture and Data Flow 16.2 ERP, Accounting Systems, and Change Management 16.3 Data Governance, SQL, and Analytics 16.4 Availability, Backup, and Recovery Controls
29 Chapter 17: ISC Security, Privacy, and SOC Engagements
17.1 Security Threats and Control Selection 17.2 Privacy, Confidentiality, and Compliance Frameworks 17.3 SOC 1, SOC 2, SOC 3, and Cybersecurity Reports 17.4 Service Organization Exceptions and User Controls
30 Chapter 18: TCP Individual Tax Planning and Personal Financial Issues
18.1 Nonroutine Individual Income and Estimated Tax 18.2 Passive, At-Risk, and Investment Planning 18.3 Retirement, Education, and Insurance Planning 18.4 Gift, Estate, and Beneficiary Concepts
31 Chapter 19: TCP Entity Compliance and Planning
19.1 C Corporation Tax Planning 19.2 S Corporation Basis and Distributions 19.3 Partnership Tax Planning and Allocations 19.4 Trusts, Tax-Exempt, and International Signals
32 Chapter 34: TCP International and Advanced Entity Tax Topics
34.1 International Tax Signals and Source of Income 34.2 CFC, Foreign Tax Credit, and Permanent Establishment Concepts 34.3 Consolidated Returns and Affiliated Corporations 34.4 Advanced Partnership and S Corp Planning Scenarios
33 Chapter 35: Choosing and Preparing for BAR, ISC, or TCP
35.1 Discipline Fit Matrix by Background 35.2 BAR, ISC, and TCP Blueprint and Skill Comparison 35.3 Discipline Study Plans and Practice Balance 35.4 Switching Disciplines, Retake, and Score Interpretation
34 Chapter 39: CPA TBS Research, Authoritative Literature, and Document Review
39.1 Document Review Simulation Method 39.2 Research and Authoritative Literature Workflow 39.3 Exhibit Overload and Relevant Data Selection 39.4 Written Explanation and Professional Judgment Drills
35 Chapter 20: CPA Simulations, Retakes, and Final Review
20.1 TBS Exhibit Triage and Workpaper Method 20.2 Section-Specific Final Review Plans 20.3 Score Release, Retake, and Credit Window Decisions 20.4 Four-Section Study Roadmaps
36 Chapter 40: Discipline Workbook Drills for BAR, ISC, and TCP
40.1 BAR Ratio, Variance, and Government Drill 40.2 ISC Control Evidence and SOC Drill 40.3 TCP Basis Planning and Entity Drill 40.4 Discipline Final Mock and Review Log
16.4 Availability, Backup, and Recovery Controls
Key Takeaways Explain This Topic AI
Availability controls support service commitments by keeping systems accessible for authorized use when needed, including during cyber events and disasters.
A business impact analysis identifies critical processes, dependencies, tolerable downtime, recovery priorities, and the resources needed to resume operations.
Recovery time objective measures how quickly service must resume; recovery point objective measures how much data loss is tolerable.
Full, incremental, and differential backups have different restore-speed, storage, and data-loss tradeoffs, so the best design depends on the recovery objectives.
Mirroring, replication, monitoring, tested restores, incident escalation, and documented procedures are far stronger evidence than an untested plan.
Last updated: June 2026
Availability as a Control Objective
Availability means information and systems are accessible for operation and use as committed or agreed. In ISC, availability is not merely an IT uptime statistic; it drives payroll processing, billing, cash receipts, inventory movement, reporting deadlines, and the availability category of SOC 2 engagements (one of the five trust services categories alongside security, confidentiality, processing integrity, and privacy).
A strong availability program includes business continuity planning (BCP) , disaster recovery planning (DRP) , backup and restoration procedures, monitoring, incident escalation, capacity management, and periodic testing. A BCP keeps the business operating (people, facilities, processes); a DRP restores the technology (systems, data, infrastructure). They overlap but are distinct documents, and the exam often forces you to pick which one a fact pattern describes.
Recovery sites are a frequent test topic. A hot site is a fully equipped, near-instant facility with current data ready for failover (supports the shortest RTO, highest cost). A warm site has hardware and connectivity but needs data restoration and configuration before use (moderate RTO and cost). A cold site is essentially empty space with power and connectivity, requiring days to equip (longest RTO, lowest cost). A mirrored/redundant site runs in parallel for immediate cutover. Match the site to the RTO: a payroll system that must recover in hours cannot rely on a cold site.
Cloud-based recovery and "disaster recovery as a service" increasingly replace physical alternate sites but follow the same RTO/cost logic.
Business Impact Analysis and Recovery Objectives
A business impact analysis (BIA) identifies critical processes and estimates the effect of disruption. It determines dependencies, peak processing periods, legal or contractual obligations, manual workarounds, recovery priorities, and resources required to resume operations. Two metrics drive recovery design and are routinely tested:
- BIA output Meaning Example
- Critical process Activity that must recover quickly Payroll direct-deposit processing
Recovery time objective (RTO) Maximum acceptable time to restore service Payroll system restored within 4 hours
Recovery point objective (RPO) Maximum acceptable data loss, measured in time No more than 15 minutes of transactions lost
- Dependency Resource needed for recovery Bank-file interface, cloud database, VPN
- Workaround Temporary procedure when system is down Manual emergency-check process
The distinction is high-yield: RTO looks forward (how fast can we be running again?); RPO looks backward (how much recent data can we afford to lose?). A short RPO demands frequent data capture; a short RTO demands fast failover and tested restores.
Mirroring, Replication, and Backup Types
Mirroring maintains an exact or near-exact copy of data or systems, often for rapid failover. Replication copies data between locations and may be synchronous (near-real-time, supports a very short RPO) or asynchronous (some delay, lower cost). These tools cut downtime and data loss but will faithfully copy corrupted or unauthorized changes if recovery points and monitoring are weak, which is why backups remain necessary.
Backup types and their tradeoffs:
Full backup: copies all selected data; simplest restore, highest storage and time cost.
Incremental backup: copies changes since the last backup of any type ; smallest and fastest to create, but restore needs the full backup plus every incremental in the chain.
Differential backup: copies changes since the last full backup ; restore needs only the full backup plus the latest differential, but each differential grows until the next full.
Restore worked example. Full backup Sunday; differentials Mon-Fri. A failure Thursday morning restores from the Sunday full plus the Wednesday differential (the latest one). With incrementals instead, you would need Sunday plus Monday, Tuesday, and Wednesday.
Availability Metrics and SOC 2 Thinking
Common measures include agreed service time, downtime, uptime percentage, incident duration, mean time to detect (MTTD) , and mean time to restore (MTTR) . In a SOC 2 availability examination, a CPA evaluates whether controls are suitably designed (Type 1) and operating effectively over a period (Type 2) to meet availability commitments and system requirements.
Strong evidence includes approved BCP/DRP documents, backup schedules, successful restore-test logs , incident tickets, monitoring alerts, capacity reports, failover-test results, and documented remediation of failed backups. Weak evidence is management asserting that backups exist without proof that data can actually be restored, an untested plan, or a contact list that has never been exercised.
Exam Focus
Start from the business requirement. If downtime tolerance is low (short RTO), choose redundancy, failover, monitoring, and tested recovery. If data-loss tolerance is low (short RPO), choose frequent backups or replication plus restoration testing. If the fact pattern mentions failed backups , the strongest response is never "buy more storage"; it is to investigate the failures, remediate the root cause, and re-test the restore.
Availability also depends on protecting backups themselves. The widely cited 3-2-1 rule keeps three copies of data on two different media with at least one copy offsite (or offline/immutable). Offline or immutable copies matter against ransomware, which deliberately encrypts both production data and any reachable backups; replication alone would faithfully copy the encrypted files. Pair recovery design with redundancy components such as uninterruptible power supplies, redundant array of independent disks (RAID) storage, and clustered servers so that a single hardware failure does not cause an outage in the first place.
Prevention reduces how often the recovery plan must be invoked.